@justai/cuts 0.63.0 → 0.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justai/cuts",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "A persona's named parts \u2014 the page shell that holds them, and the cuts themselves.",
   "license": "UNLICENSED",
   "repository": {
@@ -25,7 +25,8 @@
     "./FilePicker.astro": "./src/FilePicker.astro",
     "./ActionList.astro": "./src/ActionList.astro",
     "./ActionRow.astro": "./src/ActionRow.astro",
-    "./Files.astro": "./src/FilePicker.astro"
+    "./Files.astro": "./src/FilePicker.astro",
+    "./AuthMount.astro": "./src/AuthMount.astro"
   },
   "peerDependencies": {
     "astro": ">=5"

package/src/AuthMount.astro

@@ -0,0 +1,35 @@
+---
+// ░░ AUTH MOUNT — the sign-in avatar, and the script that fills it, as ONE thing ░░
+//
+// queries: no avatar in the toolbar · sign in missing on files · the auth avatar never appears ·
+//          data-justai-auth is empty · how does a persona get sign-in · where does sdk.js come from ·
+//          why is the auth mount a component instead of two lines
+//
+// THE TWO HALVES CANNOT BE SEPARATED, WHICH IS WHY THIS IS A COMPONENT AND NOT A SNIPPET.
+//
+// Sign-in on a persona page is a mount point plus the SDK that fills it. Both are trivial, and that is
+// exactly the problem: a surface hand-writing its own toolbar copies them BY HAND, and half a copy
+// fails silently. `files` carried `<div data-justai-auth>` in precisely the right place and never
+// loaded the script — so the div sat there, empty, for as long as anybody looked at it. Nothing
+// errored. There is no avatar and no error to explain its absence, which is the worst shape a defect
+// can take.
+//
+// Found 2026-07-31 by the founder noticing the avatar was simply not there. Measured across the
+// ecosystem at that moment: the cut had both halves, `files` had one, `me` had neither, and `feed`
+// had its own copy of both — four surfaces, three different answers to one question.
+//
+// So the pair ships as a unit. A surface either has sign-in or does not; it can no longer have half.
+//
+// WHY THE THREE SURFACES CANNOT JUST USE `Toolbar`: `/me`, `/files` and the feed carry navigation of
+// their own — a vault link, a host link, a back-to-persona mark — so they hand-write the toolbar
+// markup and always will. That is the same reason `personaScroll` moved down into @justai/core. What
+// cannot be shared is the markup; what CAN be shared is every load-bearing piece inside it, and this
+// is one of them.
+//
+// The origin is deliberately absolute. This is inherited from auth.justai.pro — one Google client for
+// the whole ecosystem, sign in once and you are you on every persona — so the src is that host and
+// never a local path, on every domain that mounts it.
+---
+
+<div data-justai-auth></div>
+<script is:inline defer src="https://auth.justai.pro/sdk.js"></script>

package/src/Toolbar.astro

@@ -53,6 +53,7 @@ interface Props {
 }
 import BackToZone from "./BackToZone.astro";
 const { sectionsLabel, profileLabel, kernelLabel, postsLabel, home = true, files = true, filesLabel = "Files" } = Astro.props;
+import AuthMount from "./AuthMount.astro";
 ---
 
 <header class="toolbar">
@@ -122,13 +123,11 @@ const { sectionsLabel, profileLabel, kernelLabel, postsLabel, home = true, files
     <div class="tb-right">
       <slot name="toolbarRight" />
       <slot name="langPicker" />
-      <div data-justai-auth></div>
+      <AuthMount />
     </div>
   </div>
   <div class="tb-title" id="tbTitle"><span class="tb-title-text" id="tbTitleText"></span></div>
 </header>
-<!-- justai auth — sign-in avatar menu, inherited from auth.justai.pro (the developer writes only the kernel) -->
-<script is:inline defer src="https://auth.justai.pro/sdk.js"></script>
 
 <style>
   /* ---- app toolbar — sticky to the top of the active region (kernel + posts); it never